Cybersecurity Information Sharing Act

From Infogalactic: the planetary knowledge core
Jump to: navigation, search

<templatestyles src="Module:Hatnote/styles.css"></templatestyles>

See also: Cyber Intelligence Sharing and Protection Act
Cybersecurity Information
Sharing Act of 2015
Great Seal of the United States
Long title To improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes
Acronyms (colloquial) CISA
Legislative history

The Cybersecurity Information Sharing Act (CISA S. 2588 [113th Congress], S. 754 [114th Congress]) is a United States federal law designed to "improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes".[1] The law allows the sharing of Internet traffic information between the U.S. government and technology and manufacturing companies. The bill was introduced in the U.S. Senate on July 10, 2014, and passed in the Senate October 27, 2015.[2] Opponents question CISA's value, believing it will move responsibility from private business to the government, thereby increasing vulnerability of personal private information, as well as dispersing personal private information across seven government agencies, including the NSA and local police.

The text of the bill was incorporated by amendment into a consolidated spending bill in the U.S. House on December 15, 2015,[3] which was signed into law by President Barack Obama on December 18, 2015.[4]

History

The Cybersecurity Information Sharing Act was introduced on July 10, 2014 during the 113th Congress, and was able to pass the Senate Intelligence Committee by a vote of 12-3.[5] The bill did not reach a full senate vote before the end of the congressional session.

The bill was reintroduced for the 114th Congress on March 12, 2015, and the bill passed the Senate Intelligence Committee by a vote of 14-1.[6] Senate Majority Leader Mitch McConnell, (R-Ky) attempted to attach the bill as an amendment to the annual National Defense Authorization Act, but was blocked 56-40, not reaching the necessary 60 votes to include the amendment.[7][8] Mitch McConnell hoped to bring the bill to senate-wide vote during the week of August 3–7,[9] but was unable to take up the bill before the summer recess. The Senate tentatively agreed to limit debate to 21 particular amendments and a manager's amendment,[10] but did not set time limits on debate. In October 2015, the US Senate took the bill back up following legislation concerning sanctuary cities.[11]

Provisions

The main provisions of the bill make it easier for companies to share personal information with the government, especially in cases of cyber security threats. Without requiring such information sharing, the bill creates a system for federal agencies to receive threat information from private companies.

With respect to privacy, the bill includes provisions for preventing the act of sharing data known to be both personally identifiable and irrelevant to cyber security. Any personal information which does not get removed during the sharing procedure can be used in a variety of ways. These shared cyber threat indicators can be used to prosecute cyber crimes, but may also be used as evidence for crimes involving physical force.[12]

Positions

Businesses and trade groups

The CISA has received some support from advocacy groups, including the United States Chamber of Commerce,[13] the National Cable & Telecommunications Association, and the Financial Services Roundtable.[12]

A number of business groups have also opposed the bill, including the Computer & Communications Industry Association,[14] as well as individual companies such as Twitter, Yelp, Apple, and Reddit.[15]

BSA (The Software Alliance) appeared initially supportive of CISA, sending a letter on July 21, 2015 urging the senate to bring the bill up for debate.[16] On September 14, 2015, the BSA published a letter of support for amongst other things cyber threat information sharing legislation addressed to Congress, signed by board members Adobe, Apple Inc., Altium, Autodesk, CA Technologies, DataStax, IBM, Microsoft, Minitab, Oracle, Salesforce.com, Siemens, and Symantec.[17] This prompted the digital rights advocacy group Fight for the Future to organize a protest against CISA.[18] Following this opposition campaign, BSA stated that its letter expressed support for cyber threat sharing legislation in general, but did not endorse CISA, or any pending cyber threat sharing bill in particular.[19][20] BSA later stated that it is opposed to CISA in its current form.[21] The Computer & Communications Industry Association, another major trade group including members such as Google, Amazon.com, Cloudflare, Netflix, Facebook, Red Hat, and Yahoo!, also announced its opposition to the bill.[22]

Government officials

Proponents of CISA include the bill's main cosponsors, senators Dianne Feinstein (D-CA) and Richard Burr (R-NC).[11]

Some senators have announced opposition to CISA, including Ron Wyden (D-OR), Rand Paul (R-KY), and Bernie Sanders (I-VT).[23]

Senator Ron Wyden (D-OR) has objected to the bill based on a classified legal opinion from the Justice Department written during the early George W Bush Administration. The Obama administration states that it does not rely on the legal justification laid out in the memo.[24][25] Wyden has made repeated requests to the US Attorney General to declassify the memo,[26] dating at least as far back as when a 2010 Office of Inspector General report cited the memo as a legal justification for the FBI's warrantless wire-tapping program.[27]

On August 4, 2015, White House spokesman Eric Schultz endorsed the legislation, calling for the senate to "take up this bill as soon as possible and pass it".[28]

The United States Department of Homeland Security initially supported the bill, with Jeh Johnson, the secretary of the DHS, calling for the bill to move forward on September 15.[29] However, in an August 3 letter to senator Al Franken (D-MN), the deputy secretary of the DHS, Alejandro Mayorkas, expressed a desire to have all connections be brokered by the DHS, given the Department's charter to protect the executive branch networks. In the letter, the DHS found issue with the direct sharing of information with all government agencies, advocating instead that the DHS be the sole recipient of cyberthreat information, allowing it to scrub out private information.[30] In addition, the Department of Homeland Security has published a Privacy Impact Assessment detailing its internal review of the proposed system for handling incoming indicators from Industry.[31]

Civil liberties groups

Privacy advocates were aghast in October when the Senate passed the Cybersecurity Information Sharing Act by a vote of 74 to 21, leaving intact portions of the law they say make it more amenable to surveillance than actual security while quietly stripping out several of its remaining privacy protections. CISA has been criticized by advocates of Internet privacy and civil liberties, such as the Electronic Frontier Foundation and the American Civil Liberties Union.[32][33] It has been compared to the criticized Cyber Intelligence Sharing and Protection Act proposals of 2012 and 2013, which passed the United States House of Representatives, but did not pass the Senate.

Similar laws in different countries

United Kingdom government policy: cyber security

The Scottish Government Information Sharing

See also

References

  1. ↑ "Discussion Draft of the 'Cybersecurity Information Sharing Act of 2014' (S.2588)", 113th Congress, 2d Session, June 11, 2014.
  2. ↑ S.754 - Cybersecurity Information Sharing Act of 2015
  3. ↑ H.R.2029 - Military Construction and Veterans Affairs and Related Agencies Appropriations Act, 2016
  4. ↑ Budget bill heads to President Obama's desk with CISA intact
  5. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  6. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  7. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  8. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  9. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  10. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  11. ↑ 11.0 11.1 Lua error in package.lua at line 80: module 'strict' not found.
  12. ↑ 12.0 12.1 Lua error in package.lua at line 80: module 'strict' not found.
  13. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  14. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  15. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  16. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  17. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  18. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  19. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  20. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  21. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  22. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  23. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  24. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  25. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  26. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  27. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  28. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  29. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  30. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  31. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  32. ↑ "A Zombie Bill Comes Back to Life: A Look at The Senate's Cybersecurity Information Sharing Act of 2014", Mark Jaycox, Electronic Frontier Foundation (EFF), June 29, 2014.
  33. ↑ "Beware the Dangers of Congress’ Latest Cybersecurity Bill", Sandra Fulton, ACLU (Washington), June 27, 2014.

External links

Retrieved from "https://infogalactic.com/w/index.php?title=Cybersecurity_Information_Sharing_Act&oldid=720634025"